The IRS doled out more than $24 billion in potentially bogus refunds claimed under several controversial tax credits in 2016, according to a new audit that said $118 million was even paid to people who weren’t authorized to work in the U.S. in the first place.

Some $16.8 billion in payments were made on improper claims under the Earned Income Tax Credit, signifying a 24 percent error rate. Investigators also estimated $7.2 billion in improper payments for the Additional Child Tax Credit, representing 25 percent of the total, and $1.1 billion in improper payments, or 24 percent, for a higher education tax credit.

The totals and error rates for the earned income and child credits were comparable for 2015, while the education tax credit saw improvement.

Both the inspector general and the tax agency said that steps have already been taken to try to prevent a repeat in the future, saying that a law passed in late 2015 should help.

Treasury Inspector General for Tax Administration J. Russell George said the IRS needs to follow through on the 2015 law, which imposes more restrictions on certain filers and delays refunds for people claiming the credits to give agents more time to flag suspicious returns.

One particular problem the IRS faces is checking people who have Social Security numbers but who aren’t authorized to work in the U.S.

Investigators found more than 49,000 of them claimed the EITC, totaling $118 million in potentially bogus payments in 2014.

Under welfare reform passed in 1996, people who claim the earned income credit have to obtain a social security card that allows them to work in the U.S., which excludes “nonwork” social security numbers frequently given to immigrant family members or children who don’t plan on working.

Auditors also found $35 million in earned income, child and education tax credits went to people who retroactively filed returns for years before they got a social security or tax filing number — a move forbidden by the 2015 law.

In response, the agency said it didn’t get enough information from the Social Security Administration to do proper cross-checks and didn’t have enough time to get everything up to speed under the 2015 law.

“There was not sufficient time to reprogram our systems for the 2016 filing season, which started on January 19, 2016, one month after the passage of the PATH Act,” Kenneth C. Corbin, commissioner of the IRS’s Wage and Investment Division, wrote in response to the report.

The agency has since taken a number of steps to fully implement the law, including a newly signed information sharing agreement with Social Security, the report said.

Another provision in the 2015 law prevents the IRS from paying out any refunds before February 15 to people who claim the earned income or additional child credit to give examiners more time to inspect the returns for possible fraud.